{"id":"CVE-2026-74470","revision":"fa0cc69369e04eb88076d5420a0efebd","records":[{"revision":"fa0cc69369e04eb88076d5420a0efebd","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74470","aliases":[],"title":"scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write\n\nresp_report_zones() sizes the reply buffer from the CDB allocation\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the\ndescriptor count:\n\n\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) -\n\t\t\t RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);\n\nFor alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()'s size_t is 32-bit\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which\npasses the !arr check, and desc = arr + 64 is then dereferenced in the\nloop -> out-of-bounds write / panic.\n\nClamp rep_max_zones to devip->nr_zones. The loop already stops at\nsdebug_capacity (after nr_zones zones), so a report can never hold more\nthan nr_zones descriptors; the clamp does not change the report, it only\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device\nproperty that can never reach 0x100000000.","state":0,"publishedAt":"2026-08-15T12:27:07.504+00:00","modifiedAt":"2026-10-16T19:05:47.666+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/scsi_debug.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"ebacb44cb2042b90951140eda806bedad23ef554\",\n                            \"lessThan\": \"7b615fc139e35c81077046df44725c532f7e2404\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"5d3e1d006bbb543259f9e31824caadbfff6a5465\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"49e5b25a0b74dbac595f122e5608fdce2918cc4e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"495058429ca55ab7fcc21977b63b92907ad68066\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"2047ed09bf13453b7d6f9431b112ec07984dd69b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"d6e6da6bc3b53231fac77ffab428da8173ee729c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7db0e0c8190a086ef92ce5bb960836cde49540aa\",\n                            \"lessThan\": \"93dde0bf2f39a0f9f57fd610aa3201ce5b753433\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c4d2d7c935a4ad20e8e726ca10499cefe4537103\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.15.8\",\n                            \"lessThan\": \"5.15.217\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.85\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/scsi/scsi_debug.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.217\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.151\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.103\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.44\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7b615fc139e35c81077046df44725c532f7e2404","https://git.kernel.org/stable/c/5d3e1d006bbb543259f9e31824caadbfff6a5465","https://git.kernel.org/stable/c/49e5b25a0b74dbac595f122e5608fdce2918cc4e","https://git.kernel.org/stable/c/495058429ca55ab7fcc21977b63b92907ad68066","https://git.kernel.org/stable/c/2047ed09bf13453b7d6f9431b112ec07984dd69b","https://git.kernel.org/stable/c/d6e6da6bc3b53231fac77ffab428da8173ee729c","https://git.kernel.org/stable/c/93dde0bf2f39a0f9f57fd610aa3201ce5b753433"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74470","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74470","identifiers":["CVE-2026-74470"]},"retained":false,"historicalAffected":[]}],"coverage":[]}